On Statistically Secure Obfuscation with Approximate Correctness - PowerPoint PPT Presentation

1 On Statistically Secure Obfuscation with Approximate Correctness Zvika Brakerski 1 Christina Brzuska 2 Nils Fleischhacker 3 1 Weizmann Institute of Science 2 Technical University Hamburg 3 Saarland University August 15, 2016

2 Statistically Secure Obfuscation r C O C ′

2 Statistically Secure Obfuscation r C O C ′ ◮ Perfect Correctness: For any circuit C ∀ x : C ′ ( x ) = C ( x )

2 Statistically Secure Obfuscation r C O C ′ ◮ Perfect Correctness: For any circuit C ∀ x : C ′ ( x ) = C ( x ) ◮ (1 − ǫ ) -Approximate Correctness: For any circuit C , � � C ′ ( x ) = C ( x ) Pr ≥ 1 − ǫ ( n ) r,x

3 Statistically Secure Obfuscation r C O C ′ ◮ Indistinguishability Obfuscator: For any pair of circuits, such that C 1 ≡ C 2 and | C 1 | = | C 2 | SD ( O ( C 1 ) , O ( C 2 )) ≤ negl ( n )

3 Statistically Secure Obfuscation r C O C ′ ◮ Indistinguishability Obfuscator: For any pair of circuits, such that C 1 ≡ C 2 and | C 1 | = | C 2 | SD ( O ( C 1 ) , O ( C 2 )) ≤ negl ( n ) ◮ (1 − δ ) -Correlation Obfuscator: For any pair of circuits, such that C 1 ≡ C 2 and | C 1 | = | C 2 | SD ( O ( C 1 ) , O ( C 2 )) ≤ δ ( n )

3 Statistically Secure Obfuscation r C O C ′ ◮ Indistinguishability Obfuscator: For any pair of circuits, such that C 1 ≡ C 2 and | C 1 | = | C 2 | SD ( O ( C 1 ) , O ( C 2 )) ≤ negl ( n ) � � ◮ (1 − δ ) -Correlation Obfuscator: For any pair of circuits, such that C 1 ≡ C 2 and | C 1 | = | C 2 | SD ( O ( C 1 ) , O ( C 2 )) ≤ δ ( n )

4 Why Do We Even Care About Approximate Correctness? Because approximate obfuscation is useful! [MMNPs16,SW14,Hol06] 1 Statistical Distance δ Allows PKE from OWF 0 . 75 0 . 5 0 . 25 0 . 1 0 . 2 0 . 3 0 . 4 0 . 5 Correctness Error ǫ

5 Main Result ◮ If statistically secure, approximately correct iO (saiO) exists, then either one-way functions do not exist, or NP ⊆ AM ∩ coAM. ◮ More Generally: If (1 − δ ) -statistically secure, (1 − ǫ ) -approximately correct correlation obfuscation (sacO) exists with δ ( n ) ≤ 1 3 − 2 1 3 ǫ ( n ) − poly ( n ) , then either one-way functions do not exist, or NP ⊆ AM ∩ coAM. ◮ For very weak parameters, a trivial construction of sacO exists with δ ( n ) = 2 ǫ ( n ) .

6 The Landscape of Correlation Obfuscation 1 Achievable with Trivial Construction 0 . 9 Ruled out by Negative Result 0 . 8 Statistical Distance δ 0 . 7 0 . 6 0 . 5 0 . 4 0 . 3 0 . 2 0 . 1 0 . 1 0 . 2 0 . 3 0 . 4 0 . 5 Correctness Error ǫ

6 The Landscape of Correlation Obfuscation 1 Achievable with Trivial Construction 0 . 9 Ruled out by Negative Result Allows PKE from OWF 0 . 8 Statistical Distance δ 0 . 7 0 . 6 0 . 5 0 . 4 0 . 3 0 . 2 0 . 1 0 . 1 0 . 2 0 . 3 0 . 4 0 . 5 Correctness Error ǫ

7 Impossibility of Perfect Correctness [GR07] Ψ un Ψ sat

7 Impossibility of Perfect Correctness [GR07] Ψ un Ψ sat 0

7 Impossibility of Perfect Correctness [GR07] Ψ un Ψ sat 0 siO siO siO

7 Impossibility of Perfect Correctness [GR07] ≡ Ψ un Ψ sat 0 siO siO siO

7 Impossibility of Perfect Correctness [GR07] Ψ un Ψ sat 0 �≡ siO siO siO

7 Impossibility of Perfect Correctness [GR07] Ψ un Ψ sat 0 siO siO siO GapSD ∈ AM ∩ coAM = ⇒ NP ⊆ AM ∩ coAM

8 Why Does the Approach Fail in the Approximate Case? Ψ sat 0 saiO saiO

8 Why Does the Approach Fail in the Approximate Case? Ψ sat 0 saiO saiO

9 Overview of Our Approach C Y C X [ k, Ψ] saiO saiO

9 Overview of Our Approach C Y C X [ k, Ψ un ] ≡ saiO saiO

9 Overview of Our Approach x 0 x 0 C Y a � = C X [ k, Ψ sat ] b ∼ ∼ ∼ saiO saiO

9 Overview of Our Approach ≡ C Y C X [ k, Ψ sat ] C saiO saiO

9 Overview of Our Approach ≡ ≈ C Y C X [ k, Ψ sat ] C saiO saiO

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x )

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x )

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x ) ◮ Security: 1 n BP x 0 k ← $ { 0 , 1 } n , k ∗ = Puncture ( k, x 0 )

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x ) ◮ Security: 1 n BP x 0 k ← $ { 0 , 1 } n , k ∗ = Puncture ( k, x 0 )

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x ) ◮ Security: 1 n BP x 0 k ← $ { 0 , 1 } n , k ∗ = Puncture ( k, x 0 ) k ∗ , PRF ( k, x 0 ) BP

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x ) ◮ Security: 1 n BP x 0 k ← $ { 0 , 1 } n , k ∗ = Puncture ( k, x 0 ) k ∗ , PRF ( k, x 0 ) k ∗ , b ← $ { 0 , 1 } BP BP

10 Puncturable Pseudorandom Functions [BW13,BGI14,KPTZ13] k ∗ ← Puncture ( k, x 0 ) b ← PRF ( k, x ) ◮ Functionality Preserved Under Puncturing: For all x � = x 0 , PRF ( k ∗ , x ) = PRF ( k, x ) ◮ Security: 1 n BP x 0 k ← $ { 0 , 1 } n , k ∗ = Puncture ( k, x 0 ) k ∗ , PRF ( k, x 0 ) k ∗ , b ← $ { 0 , 1 } ≈ BP BP

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x )

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1 b = PRF ( k, x 0 )

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1 b = PRF ( k, x 0 ) C [ k ∗ , x 0 , b ] ≡ PRF ( k, · )

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1 b = PRF ( k, x 0 ) C [ k ∗ , x 0 , b ] ≡ PRF ( k, · ) C PRF ← saiO ( PRF ( k, · )) Pr[ C PRF ( x 0 ) = b ] ≥ 1 − ǫ Pr[ C ′ ( x 0 ) = b ] � 1 − ǫ

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1 b = PRF ( k, x 0 ) C [ k ∗ , x 0 , b ] ≡ PRF ( k, · ) PRF security Pr[ C ′ ( x 0 ) = b ] � 1 − ǫ Pr[ C ′ ( x 0 ) = b ] � 1 − ǫ

11 Enforcing Large Statistical Distance C [ k ∗ , x 0 , b ]( x ) if x = x 0 Let C ′ denote saiO ( C [ k ∗ , x 0 , b ]) . return b else return PRF ( k ∗ , x ) b = PRF ( k, x 0 ) ⊕ 1 b = PRF ( k, x 0 ) Pr[ C PRF ( x 0 ) = PRF ( k, x 0 )] ≥ 1 − ǫ C [ k ∗ , x 0 , b ] ≡ PRF ( k, · ) ∧ Pr[ C ′ ( x 0 ) � = PRF ( k, x 0 )] � 1 − ǫ = ⇒ SD ( C PRF , C ) � 1 − 2 ǫ PRF security Pr[ C ′ ( x 0 ) = b ] � 1 − ǫ Pr[ C ′ ( x 0 ) = b ] � 1 − ǫ

12 Restriction to Unique-SAT ◮ We restrict our attention to Unique-SAT (USAT) ◮ USAT is NP hard via a randomized reduction [VV85] ◮ Combining this with previous results [MX10,BL13] we show that USAT ∈ BPP GapSD = ⇒ SAT ∈ AM ∩ coAM

13 The Formula-Indexed Circuit C X [ k, s, Ψ]( x ) if Ψ( x ⊕ s ) = 1 return PRF ( k, x ) ⊕ 1 else return PRF ( k, x )

13 The Formula-Indexed Circuit C X [ k, s, Ψ]( x ) if Ψ( x ⊕ s ) = 1 return PRF ( k, x ) ⊕ 1 else return PRF ( k, x ) Ψ ∈ USAT Ψ ∈ UNSAT

13 The Formula-Indexed Circuit C X [ k, s, Ψ]( x ) if Ψ( x ⊕ s ) = 1 return PRF ( k, x ) ⊕ 1 else return PRF ( k, x ) Ψ ∈ USAT Ψ ∈ UNSAT C X [ k, s, Ψ] ≡ PRF ( k, · )

13 The Formula-Indexed Circuit C X [ k, s, Ψ]( x ) if Ψ( x ⊕ s ) = 1 return PRF ( k, x ) ⊕ 1 else return PRF ( k, x ) Ψ ∈ USAT Ψ ∈ UNSAT C X [ k, s, Ψ] ≡ C [ k ∗ , x 0 , b ] C X [ k, s, Ψ] ≡ PRF ( k, · ) x 0 = x ψ ⊕ s for b = PRF ( k, x 0 ) ⊕ 1

14 Putting it All Together X [Ψ](1 n ) Y (1 n ) k ← $ { 0 , 1 } n k ← $ { 0 , 1 } n s ← $ { 0 , 1 } n s ← $ { 0 , 1 } n C := C X [ k, s, Ψ] C := PRF ( k, · ) C ′ ← $ O ( C ) C ′ ← $ O ( C ) return ( k, s, C ′ ) return ( k, s, C ′ ) Ψ ∈ UNSAT ⇐ ⇒ SD ( X [Ψ] , Y ) ≤ negl ( n ) Ψ ∈ USAT ⇐ ⇒ SD ( X [Ψ] , Y ) � 1 − 2 ǫ ◮ We can therefore decide USAT in BPP GapSD . ◮ Thus, if saiO and one-way functions both exist, then NP ⊆ AM ∩ coAM and the polynomial hierarchy collapses.